Elastic Agent 8.19.13 < 8.19.22 / 9.2.7 <= 9.2.8 / 9.3.x <= 9.3.8 / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-194)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364477);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/09");

  script_cve_id("CVE-2026-102413");
  script_xref(name:"IAVA", value:"2026-A-1095");

  script_name(english:"Elastic Agent 8.19.13 < 8.19.22 / 9.2.7 <= 9.2.8 / 9.3.x <= 9.3.8 / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-194)");

  script_set_attribute(attribute:"synopsis", value:
"The Elastic Agent (Elastic Endpoint) installation on the remote Windows host is affected by a denial of service
vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Elastic Agent / Elastic Endpoint installed on the remote Windows host is 8.19.13 through 8.19.21, or
9.2.7 through 9.2.8, or 9.3.x through 9.3.8, or 9.4.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore,
affected by a denial of service vulnerability as referenced in the ESA-2026-194 advisory.

  - Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted
    file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system
    locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled
    exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and
    restart repeatedly, which can degrade or disable Elastic Defend's real-time malware prevention and
    behavioral detection capabilities on the affected host for as long as the condition persists.
    (CVE-2026-102413)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?39c5f526");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elastic Agent / Elastic Endpoint version 8.19.22, 9.4.8, or 9.5.5 or later as appropriate for your release
branch. No fix is available for the 9.2.x and 9.3.x release lines; upgrade to a supported release line.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-102413");

  script_cwe_id(248);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/09");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:elastic_agent");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elastic_agent_win_installed.nbin");
  script_require_keys("installed_sw/Elastic Agent", "SMB/Registry/Enumerated", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# Only hosts running certain Windows system locales (including Chinese, Japanese and Korean) are affected; the system
# locale configuration is not checked.
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}},
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'Elastic Agent', 'type': 'app'},
      'check_algorithm': 'default',
      'potential_vulnerability': {
        'missing_config_check': true
      },
      'constraints': [
        {'min_version': '8.19.13', 'fixed_version': '8.19.22'},
        {'min_version': '9.2.7', 'max_version': '9.2.8', 'fixed_display': 'See vendor advisory'},
        {'min_version': '9.3.0', 'max_version': '9.3.8', 'fixed_display': 'See vendor advisory'},
        {'min_version': '9.4.0', 'fixed_version': '9.4.8'},
        {'min_version': '9.5.0', 'fixed_version': '9.5.5'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);